UpHeron

Vulnerability database · updated every 15 minutes

New vulnerabilities in the software websites run.

CVEs and security advisories for WordPress, its plugins and themes, npm, PyPI and the servers behind websites, merged from NVD, the CVE Program, GitHub, OSV.dev and WPVulnerability, with CISA's list of the ones attackers exploit.

Free · right away or once a day · unsubscribe in one click
Tracked
32,656
Published in 7 days
784
Critical in 30 days
194
Actively exploited
405

Latest vulnerabilities

32,656 vulnerabilities
  1. Medium 4.9

    CVE-2024-5067 · GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles.

    Published 24 Jul 2024 · Fixed in 17.0.5, 17.1.3, 17.2.1 · NVD
  2. Low 2.7

    CVE-2024-0231 · GitLab

    A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits.

    Published 24 Jul 2024 · Fixed in 17.0.5, 17.1.3 · NVD
  3. Medium 6.5

    CVE-2024-41666 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD has a Web-based terminal that allows users to get a shell inside a running pod, just as they would with kubectl exec. Starting in version 2.6.0, when the administrator enables this function and grants permission to the user `p, role:myrole, exec, create, */*, allow`, even if the user revokes this permission, the…

    Published 24 Jul 2024 · Fixed in 2.9.21, 2.10.16, 2.11.7 · NVD
  4. Medium 4.3

    CVE-2024-21684 · Bitbucket Data Center

    There is a low severity open redirect vulnerability within affected versions of Bitbucket Data Center. Versions of Bitbucket DC from 8.0.0 to 8.9.12 and 8.19.0 to 8.19.1 are affected by this vulnerability. It is patched in 8.9.13 and 8.19.2. This open redirect vulnerability, with a CVSS Score of 3.1 and a CVSS Vector of CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, allows an unauthenticated…

    Published 24 Jul 2024 · Fixed in 8.9.13, 8.19.2 · NVD
  5. Medium 4.3

    CVE-2024-6874 · curl

    libcurl's URL API function [curl_url_get()](https://curl.se/libcurl/c/curl_url_get.html) offers punycode conversions, to and from IDN. Asking to convert a name that is exactly 256 bytes, libcurl ends up reading outside of a stack based buffer when built to use the *macidn* IDN backend. The conversion function then fills up the provided buffer exactly - but does not null terminate the string.…

    Published 24 Jul 2024 · NVD
  6. High 7.5

    CVE-2024-6197 · curl

    libcurl's ASN1 parser has this utf8asn1str() function used for parsing an ASN.1 UTF-8 string. Itcan detect an invalid field and return error. Unfortunately, when doing so it also invokes `free()` on a 4 byte localstack buffer. Most modern malloc implementations detect this error and immediately abort. Some however accept the input pointer and add that memory to its list of available chunks. This…

    Published 24 Jul 2024 · Fixed in 8.9.0 · NVD
  7. Medium 5.4

    CVE-2024-41656 · Sentry

    Sentry is an error tracking and performance monitoring platform. Starting in version 10.0.0 and prior to version 24.7.1, an unsanitized payload sent by an Integration platform integration allows storing arbitrary HTML tags on the Sentry side with the subsequent rendering them on the Issues page. Self-hosted Sentry users may be impacted in case of untrustworthy Integration platform integrations…

    Published 23 Jul 2024 · Fixed in 24.7.1 · NVD
  8. Critical 9.9

    CVE-2024-41110 · Docker Engine

    Authz zero length regression

    Published 23 Jul 2024 · Project advisories (GitHub)
  9. Medium 5.9

    CVE-2024-39702 · OpenResty

    In lj_str_hash.c in OpenResty 1.19.3.1 through 1.25.3.1, the string hashing function (used during string interning) allows HashDoS (Hash Denial of Service) attacks. An attacker could cause excessive resource usage during proxy operations via crafted requests, potentially leading to a denial of service with relatively few incoming requests. This vulnerability only exists in the OpenResty fork in…

    Published 23 Jul 2024 · Fixed in 1.19.9.2, 1.21.4.4 · NVD
  10. Low 3.5

    CVE-2024-41839 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by an Improper Input Validation vulnerability that could lead to a security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and affect the integrity of the page. Exploitation of this issue requires user interaction.

    Published 23 Jul 2024 · Fixed in 6.5.21.0, 2024.5.0 · NVD
  11. Medium 5.4

    CVE-2024-34128 · Adobe Experience Manager

    Adobe Experience Manager versions 6.5.20 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim’s browser when they browse to the page containing the vulnerable field.

    Published 23 Jul 2024 · Fixed in 6.5.21.0 · NVD
  12. Medium 5.4

    CVE-2024-3246 · LiteSpeed Cache

    LiteSpeed Cache: Cross-Site Request Forgery (CSRF)

    Published 23 Jul 2024 · Fixed in 6.3 · NVD, WPVulnerability
  13. High 7.5

    CVE-2024-40634 · Argo CD

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the…

    Published 22 Jul 2024 · Fixed in 2.9.20, 2.10.15, 2.11.6 · NVD
  14. High 7.5

    CVE-2024-41829 · TeamCity

    In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection

    Published 22 Jul 2024 · Fixed in 2024.07 · NVD
  15. Medium 6.5

    CVE-2024-41828 · TeamCity

    In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time

    Published 22 Jul 2024 · Fixed in 2024.07 · NVD
  16. Critical 9.8

    CVE-2024-41827 · TeamCity

    In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration

    Published 22 Jul 2024 · Fixed in 2024.07 · NVD
  17. Medium 4.8

    CVE-2024-41826 · TeamCity

    In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection page

    Published 22 Jul 2024 · Fixed in 2024.07 · NVD
  18. Medium 5.4

    CVE-2024-41825 · TeamCity

    In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tab

    Published 22 Jul 2024 · Fixed in 2024.07 · NVD
  19. Medium 6.5

    CVE-2024-41824 · TeamCity

    In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases

    Published 22 Jul 2024 · Fixed in 2024.07 · NVD
  20. Medium 4.8

    CVE-2024-41709 · Backdrop CMS

    Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission.

    Published 22 Jul 2024 · Fixed in 1.27.3, 1.28.2 · NVD
  21. Critical 9.8

    CVE-2024-41704 · LibreChat

    LibreChat through 0.7.4-rc1 does not validate the normalized pathnames of images.

    Published 22 Jul 2024 · NVD
  22. Critical 9.8

    CVE-2024-41703 · LibreChat

    LibreChat through 0.7.4-rc1 has incorrect access control for message updates.

    Published 22 Jul 2024 · NVD
  23. Low 2.1

    CVE-2024-6933 · LimeSurvey

    A flaw has been found in LimeSurvey 6.5.14-240624. Affected by this issue is the function actionUpdateSurveyLocaleSettingsGeneralSettings of the file /index.php?r=admin/database/index/updatesurveylocalesettings_generalsettings of the component Survey General Settings Handler. This manipulation of the argument Language causes sql injection. The attack is possible to be carried out remotely. The…

    Published 21 Jul 2024 · Fixed in 6.6.2 · NVD
  24. Low 2.7

    CVE-2024-6694 · WP Mail Smtp (WordPress plugin)

    WP Mail SMTP by WPForms – Free SMTP Plugin with Gmail, Outlook, Amazon SES, SendGrid, Mailgun, Zoho & other SMTP: Storing Passwords in a Recoverable Format

    Published 19 Jul 2024 · Fixed in 4.1.0 · WPVulnerability
  25. High 7.5

    CVE-2024-31143 · Xen

    An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, the setting up of these consecutive vectors needs to happen all in one go. In this handling an error path could be taken in different situations, with or without a particular lock held. This error path wrongly releases the lock even when it is not currently…

    Published 18 Jul 2024 · NVD
  26. High 7.5

    CVE-2024-40898 · Apache HTTP Server

    SSRF in Apache HTTP Server on Windows with mod_rewrite in server/vhost context, allows to potentially leak NTML hashes to a malicious server via SSRF and malicious requests. Users are recommended to upgrade to version 2.4.62 which fixes this issue.

    Published 18 Jul 2024 · Fixed in 2.4.62 · NVD
  27. Medium 5.3

    CVE-2024-40725 · Apache HTTP Server

    A partial fix for  CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances where files are requested indirectly, result in source code disclosure of local content. For example, PHP scripts may be served instead of interpreted. Users are recommended to upgrade…

    Published 18 Jul 2024 · NVD
  28. High 7.5

    CVE-2024-40764 · SonicWall SonicOS

    Heap-based buffer overflow vulnerability in the SonicOS IPSec VPN allows an unauthenticated remote attacker to cause Denial of Service (DoS).

    Published 18 Jul 2024 · Fixed in 6.5.4.v-21s-rc2457, 7.0.1-5161, 7.1.1-7058 · NVD
  29. Medium 5.4

    CVE-2024-32981 · Silverstripe CMS

    Silverstripe framework is the PHP framework forming the base for the Silverstripe CMS. In affected versions a bad actor with access to edit content in the CMS could add send a specifically crafted encoded payload to the server, which could be used to inject a JavaScript payload on the front end of the site. The payload would be sanitised on the client-side, but server-side sanitisation doesn't…

    Published 17 Jul 2024 · Fixed in 5.2.16 · NVD
  30. High 8.8

    CVE-2024-39877 · Apache Airflow

    Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to version 2.9.3 or later which has removed the vulnerability.

    Published 17 Jul 2024 · Fixed in 2.9.3 · NVD
  31. Medium 5.4

    CVE-2024-39863 · Apache Airflow

    Apache Airflow versions before 2.9.3 have a vulnerability that allows an authenticated attacker to inject a malicious link when installing a provider. Users are recommended to upgrade to version 2.9.3, which fixes this issue.

    Published 17 Jul 2024 · Fixed in 2.9.3 · NVD
  32. Medium 5.3

    CVE-2024-6595 · GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.

    Published 17 Jul 2024 · Fixed in 16.11.6, 17.0.4, 17.1.2 · NVD
  33. Medium 4.9

    CVE-2024-21185 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.38, 8.4.1 and 9.0.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable…

    Published 16 Jul 2024 · NVD
  34. High 7.5

    CVE-2024-21183 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or…

    Published 16 Jul 2024 · NVD
  35. High 7.5Actively exploited

    CVE-2024-21182 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized access to critical data or…

    Published 16 Jul 2024 · NVD
  36. Critical 9.8

    CVE-2024-21181 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server. CVSS…

    Published 16 Jul 2024 · NVD
  37. Medium 4.9

    CVE-2024-21179 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  38. Medium 6.5

    CVE-2024-21177 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  39. Medium 5.3

    CVE-2024-21176 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). Supported versions that are affected are 8.4.0 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Jul 2024 · NVD
  40. Critical 9.1

    CVE-2024-21175 · Oracle WebLogic Server

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or…

    Published 16 Jul 2024 · NVD
  41. Medium 4.9

    CVE-2024-21173 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  42. Medium 6.5

    CVE-2024-21171 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  43. Medium 5.9

    CVE-2024-21166 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification…

    Published 16 Jul 2024 · NVD
  44. Medium 4.9

    CVE-2024-21165 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Pluggable Auth). Supported versions that are affected are 8.0.37 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently…

    Published 16 Jul 2024 · NVD
  45. Medium 5.5

    CVE-2024-21163 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jul 2024 · NVD
  46. Medium 4.9

    CVE-2024-21162 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang…

    Published 16 Jul 2024 · NVD
  47. Medium 4.9

    CVE-2024-21160 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  48. Medium 4.9

    CVE-2024-21159 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.3.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  49. Medium 4.9

    CVE-2024-21157 · MySQL

    Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.36 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or…

    Published 16 Jul 2024 · NVD
  50. High 7.4

    CVE-2024-21147 · Java

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM Enterprise Edition: 20.3.14 and 21.3.10. Difficult to exploit vulnerability…

    Published 16 Jul 2024 · NVD

Where it comes from

The list holds every advisory UpHeron reads for the software it watches: WordPress and every plugin and theme its plugin reports, the packages in monitored repositories and manifests, and the servers and frameworks found on monitored websites. One vulnerability from several sources is one entry, under its CVE.

  • NVD, the US National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
  • New and changed records of the CVE Program, read every 15 minutes, so a rating or fix added after a CVE is published reaches the list, and its alerts, within the hour. CVE content © 1999–2026 The MITRE Corporation, used under the CVE terms of use; CVE® is a registered trademark of The MITRE Corporation.
  • OSV.dev, with the GitHub Advisory Database (CC BY 4.0).
  • WPVulnerability (CC0) for WordPress plugins and themes, and WordPress's own security advisories.
  • Node.js's own security release posts, read every 15 minutes, which name its vulnerabilities the day they are fixed, days before their CVE records.
  • The security advisories projects publish on GitHub, and the CVEs libraries such as Brotli name in their release notes, which also count for the runtimes that bundle them.
  • CISA's Known Exploited Vulnerabilities catalog.

Each day's new ones, grouped, and every critical one as soon as we find it: on the blog.

Run WordPress? The UpHeron plugin alerts you the day one of these affects your own site.